Skip to content
Permalink
Browse files
Crash using @tryGetById in DFG
https://bugs.webkit.org/show_bug.cgi?id=156992

Reviewed by Filip Pizlo.

We need to spill live registers when compiling TryGetById in DFG.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileTryGetById):
* tests/stress/regress-156992.js: New test.
(tryMultipleGetByIds):
(test):


Canonical link: https://commits.webkit.org/175104@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200048 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
msaboff committed Apr 25, 2016
1 parent 7c5c9ae commit f009482aa4697b1e4f07c1a4d099c03cbaa374fb
Showing with 49 additions and 1 deletion.
  1. +15 −0 Source/JavaScriptCore/ChangeLog
  2. +1 −1 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
  3. +33 −0 Source/JavaScriptCore/tests/stress/regress-156992.js
@@ -1,3 +1,18 @@
2016-04-25 Michael Saboff <msaboff@apple.com>

Crash using @tryGetById in DFG
https://bugs.webkit.org/show_bug.cgi?id=156992

Reviewed by Filip Pizlo.

We need to spill live registers when compiling TryGetById in DFG.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileTryGetById):
* tests/stress/regress-156992.js: New test.
(tryMultipleGetByIds):
(test):

2016-04-25 Saam barati <sbarati@apple.com>

We don't have to parse a function's parameters every time if the function is in the source provider cache
@@ -976,7 +976,7 @@ void SpeculativeJIT::compileTryGetById(Node* node)

base.use();

cachedGetById(node->origin.semantic, baseRegs, resultRegs, node->identifierNumber(), JITCompiler::Jump(), DontSpill, AccessType::GetPure);
cachedGetById(node->origin.semantic, baseRegs, resultRegs, node->identifierNumber(), JITCompiler::Jump(), NeedToSpill, AccessType::GetPure);

jsValueResult(resultRegs, node, DataFormatJS, UseChildrenCalledExplicitly);
break;
@@ -0,0 +1,33 @@
// Verify that DFG TryGetById nodes properly save live registers. This test should not crash.

function tryMultipleGetByIds() { return '(function (base) { return @tryGetById(base, "value1") + @tryGetById(base, "value2") + @tryGetById(base, "value3"); })'; }


let get = createBuiltin(tryMultipleGetByIds());
noInline(get);

function test() {
let obj1 = {
value1: "Testing, ",
value2: "testing, ",
value3: "123",
expected: "Testing, testing, 123"
};
let obj2 = {
extraFieldToMakeThisObjectDifferentThanObj1: 42,
value1: 20,
value2: 10,
value3: 12,
expected: 42
};

let objects = [obj1, obj2];

for (let i = 0; i < 200000; i++) {
let obj = objects[i % 2];
if (get(obj) !== obj.expected)
throw new Error("wrong on iteration: " + i);
}
}

test();

0 comments on commit f009482

Please sign in to comment.